Subject: New DN attribute - Problem or not?

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 22 Jun 2004 21:18:11 +0200

Sombody suggested (extract from a PI discussion):

 "That attribute could be a generic "URI" attribute (like the
  email address attribute), which could be referenced (like SN)
  from a future version of the PI RFC, or it could
  be a specific "PI Authority" attribute which would eliminate
  the need for the PI SubjectAltName extension entirely for
  PKIs that adopt that attribute."

Question: Is it a viable approach to introduce new DN attributes
from an interoperability point of view?

Anders

---

From: Joseph Doekbrijder <[email-masked]>
Date: Thu, 24 Jun 2004 09:00:52 +0200

Hi Anders

This issue would ad yet another variable to the stuff that can be put 
into the cert. But since we can make PKI work without all these 
variables (all we need in a cert, really, is a name and an emailaddress) 
there is no need for it.
I do understand that certain environments would be helped with such a 
"fix" variable but there are very elegant solutions available to solve 
these requirements in other ways....

I still favour the approach to have a little information as possible in 
a certificate (Ideally they are empty :-) )

Cheers

Josh

-- 
Joseph A. Doekbrijder
--------------------------------------------------
SwissSign AG
Löwenstrasse 1, CH-8001 Zürich
Tel: +41 43 344 88 11 / Mobile: +41 79 211 24 46
www.swisssign.com
--------------------------------------------------

This message has been digitally signed to ensure unaltered and 
authenticated reception. Should you receive an error message regarding 
the validity of the signature, please click and download the SwissSign 
root certificate using the following link  https://swisssign.net/trust/
After installation, your mail client will be able to automatically 
verify the authenticity of e-mail messages sent to you by users of 
SwissSign certificates.

---

From: Ed Gerck <[email-masked]>
Date: Thu, 24 Jun 2004 10:01:16 -0700

Joseph Doekbrijder wrote:
 >...
> a certificate ...

Yes, also because the more fields (attributes) you have in a cert, the lesser
its useful lifetime. The lifetime of a cert is the inversely proportional to
the sum of the inverse lifetime of each attribute: 1/T ~ 1/A1 + 1/A2 + ...
In particular, the lifetime of a certificate is less than the lifetime
of any of its attributes.

Cheers,
Ed Gerck

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 24 Jun 2004 20:57:41 +0200

Thanx Guys,
I think that you ansered another question which I did not put :-)

But I agree with the "light" ID concept.

Anders

----- Original Message ----- 
From: "Ed Gerck" <[email-masked]>
To: "Joseph Doekbrijder" <[email-masked]>
Cc: "Anders Rundgren" <[email-masked]>; <[email-masked]>
Sent: Thursday, June 24, 2004 19:01
Subject: Re: New DN attribute - Problem or not?

Cheers,
Ed Gerck